Isolated VLAN

[ben robin]

I would like to set a isolated VLAN on multiple switches (nexus 5548), I would like to create such VLAN so its members can be accessible only from the same VLAN members. the setting is some end devices belonging to the same VLAN in the configuration below:

end-devices---2xswitches===2xswitches----end-devices

[Philip D'Ath]

Is there a reason you can just create a normal VLAN and place all of those devices into it?

[ben robin]

A normal VLAN will bereachable through the network, which i dont want.

[Predrag Jovic]

Normal VLAN would be reachable through network only if there is interface VLAN (SVI) with assigned address and no filtering all traffic is configured. If there is no IP address for SVI or no SVI - VLAN can't be accessible. Even if there is SVI with IP address you can still filter all traffic on SVI (in both directions).

There is no difference between "normal" and "private VLAN". Private VLANs have different purpose (devices still can be reachable in private VLANs - depending on configuration just as it is in "normal" VLAN).

[ben robin]

Thanks for answering crni00000, in case if I set up no VLAN interface I am afraid the VLAN wont be reachable for other VLAN members connected to other switches.

[Predrag Jovic · Accepted solution]

SVI is needed only in the case that you need to permit traffic from/to devices that are outside your VLAN (for example to be used as default gateway). Devices located in the same VLAN on different switches, if configured correctly, are able to forward traffic to each other. In that sense, "normal" VLAN is isolated from all other hosts outside specific VLAN if SVI is not present and IP address is not assign to it.

I am deliberately ignoring the fact that VLAN can still have attached L3 device to one of its ports that can be used for routing (instead of SVI)...

[paul driver]

Hello

Do you require these vlan users to access the outside world? if so then a Routed acl (RACL) would be appllicable assigned to the SVI of the Vlan your wish to segragate, otherwise a simple L2 vlan with no L3 interface would be applicable.

res
Paul

[ben robin]

Thank you, I will go with the L2 Vlan solution.